Our company currently operates with one full time employee, the director, and five part time employees. As the company grows, it will from time to time review the need to incorporate a whistleblowing policy. It will seek guidance in this from the expert whistleblowing campaigning and advocacy group with which it co-developed this question, Public Concern at Work.
As we carry out our work in administering the Responsible 100 initiative we will routinely assess other businesses' answers to this (and other) questions and score answers against the accompanying scorecard. In doing this, we will become aware of other SME and micro businesses' answers to this whistleblowing question. As a result, we will learn what comparable companies do in respect of whistleblowing and which good policies and practices they pursue which we might also consider adopting.
Every employer faces the risk that something will go badly wrong in their organisation and ought to welcome the opportunity to address it as early as possible. Whenever such a situation arises, the first people to know of such a risk will usually be those who work in the organisation. Yet while these are the people best placed to speak up (known as “whistleblowing”) before damage is done, they often have the most to lose if they do.
Whistleblowing arrangements are a vital component of good governance and risk management in any organisation or industry. Effective whistleblowing can ensure that disaster is averted, costly legal claims are avoided and reputation is preserved. Benefits go beyond detecting wrongdoing and include deterring malpractice and improving standards and quality. A responsible approach to whistleblowing also helps organisation to promote a healthy workplace culture built on openness and accountability.
A Code of Practice (CoP) has been developed by the Whistleblowing Commission. The CoP provides practical guidance to employers, workers and their representatives and sets out recommendations for raising, handling, training and reviewing whistleblowing in the workplace. This code has been referred to by the Financial Conduct Authority and Prudential Regulation Authority in the guidance for the new rules on whistleblowing arrangements for deposit takers and banks.
The contents of the CoP are as follows:
- As part of the whistleblowing arrangements, there should be written procedures covering the raising and handling of concerns. These procedures should be clear, readily available, well-publicised and easily understandable.
- The written procedures for raising and handling concerns:
- should identify the types of concerns to which the procedure relates, giving examples relevant to the employer;
- should include a list of the persons and bodies with whom workers can raise concerns, this list should be sufficiently broad to permit the worker, according to the circumstances, to raise concerns with:
- the worker’s line manager;
- more senior managers;
- an identified senior executive and /or board member; and
- relevant external organisations (such as regulators);
- should require an assurance to be given to the worker that he/she will not suffer detriment for having raised a concern, unless it is later proved that the information provided by the worker was false to his or her knowledge;
- should require an assurance to be given to the worker that his or her identity will be kept confidential if the worker so requests unless disclosure is required by law;
- should require that a worker raising a concern:
- be told how and by whom the concern will be handled;
- be given an estimate of how long the investigation will take;
- be told, where appropriate, the outcome of the investigation 
- be told that if the worker believes that he/she is suffering a detriment for having raised a concern, he/she should report this; and
- be told that he/she is entitled to independent advice.
- The employer should not only comply with these procedures but should also sanction those who subject an individual to detriment because he/she has raised a concern and should inform all workers accordingly.
- In addition to the written procedure for raising and handling concerns, the employer should:
- identify how and when concerns should be recorded;
- ensure, through training at all levels, the effective implementation of the whistleblowing arrangements;
- identify the person with overall responsibility for the effective implementation of the whistleblowing arrangements;
- conduct periodic audits of the effectiveness of the whistleblowing arrangements, to include at least:
- a record of the number and types of concerns raised and the outcomes of investigations;
- feedback from individuals who have used the arrangements;
- any complaints of victimisation;
- any complaints of failures to maintain confidentiality;
- a review of other existing reporting mechanisms, such as fraud, incident reporting or health and safety reports;
- a review of other adverse incidents that could have been identified by staff (e.g. consumer complaints, publicity or wrongdoing identified by third parties);
- a review of any relevant litigation; and
- a review of staff awareness, trust and confidence in the arrangements.
- make provision for the independent oversight and review of the whistleblowing arrangements by the Board, the Audit or Risk Committee or equivalent body. This body should set the terms of reference for the periodic audits set out in 7(d) and should review the reports.
- Where an organisation publishes an annual report, that report should include information about the effectiveness of the whistleblowing arrangements, including:
- the number and types of concerns raised;
- any relevant litigation; and
- staff awareness, trust and confidence in the arrangements.
"Informants" may be a) employees with the duty to inform (their disclosure is not a matter of ethics but a legal obligation), or b) those with personal involvement in the wrongdoing who disclose information in order to justify their role or reduce their liability.
A "complaint" is seeking redress or justice by an individual who has personally been poorly treated, perhaps through a breach of their individual employment rights or bullying within the workplace. The complainant has a vested interest in the outcome of the complaint - and therefore is usually expected to be able to prove their case.
- Genuine concerns
A "genuine concern" is where a worker has a reasonable belief that the disclosure is in the public interest, and tends to show wrongdoing, risk or malpractice.
- Openness, anonymity & confidentiality
The qualities of “openness”, “anonymity” and “confidentiality” are essential in the whistleblowing context. The best way to raise a concern is to do so openly. Openness makes it easier for the employer to assess the issue, work out how to investigate the matter and obtain more information. A worker raises a concern confidentially if he or she gives his or her name on the condition that it is not revealed without his or her consent. It is important that this is a clear option for anyone to use when raising a concern. A worker raises a concern anonymously if he or she does not give his or her name at all. If this happens, it is best for the organisation to assess the anonymous information as best it can to establish whether there is substance to the concern and whether it can be addressed. Clearly if no-one knows who provided the information it is not possible to reassure or protect them.
- Detriment & disadvantage
The code at paragraph 5(c) requires an assurance that a worker will not suffer a “detriment” for having raised a concern. Paragraph 6 of the code states that an employer should also sanction those who subject an individual to detriment. Subjecting a worker to a detriment means subjecting the worker to “any disadvantage” because they blew the whistle. This could include (but is not limited to) any of the following:
- failure to promote;
- denial of training;
- closer monitoring;
- blocking access to resources;
- unrequested re-assignment or re-location;
- disciplinary sanction;
- bullying or harassment;
- failure to provide an appropriate reference; or
- failing to investigate a subsequent concern
- All Businesses MUST
Describe their practices and policies to encourage and address employee concerns about wrongdoing in the workplace
Confirm that employees are not penalised for such actions, describe how this is ensured, and what procedures for redress are in place if detriments do happen
Describe how confidentiality is protected
- All Businesses MAY
Provide examples, e.g. describe some concerns that have been raised by whistleblowers and subsequently resolved
Explain how they encourage employees’ participation in raising issues of concern
Describe training provided to staff
Provide previous annual reports or data regarding whistleblowing policies, if available
Describe who is covered by this policy, e.g. contractors, employees, volunteers
Explain how they assess effectiveness of the policy within the organisation
Explain how they ensure staff are aware of the policy
- Large and Multinational Corporations (MNCs) MUST
Explain if their practices differ from one country to another
Justify these differences, if any
- All Businesses MUST
Explain why they do not or cannot answer YES to this question, listing the business reasons, any mitigating circumstances or other reasons that apply
- All Businesses MAY
List any practices that are relevant, but not sufficient to answer YES
Mention any future intentions regarding this issue
DON'T KNOW is not a permissible answer to this question
NOT APPLICABLE is not a permissible answer to this question
- To receive a score of 'Excellent'
Clear commitment to whistleblowing process with leadership at every level of management. Complete compliance with the Code, providing positive examples of whistleblowing arrangements working in practice and treatment of whistleblowers from information gathered under sections four and five of the code
e.g. 1 high levels of employee awareness, trust and confidence to raise concerns
e.g. 2 increasing numbers of concerns being raised openly and corresponding reduction in anonymous concerns
e.g. 3 focused campaigns around key risks based on own audit, review and research
e.g. 4 regular refreshment and clarification of whistleblowing messages to employees
e.g. 5 comprehensive and well established training across the entire organisation to both managers and staff
e.g. 6 examples of early detection of fraud, malpractice or aversion of harm as the result of a member of staff blowing the whistle.
e.g. 7 communication of such positive outcomes across the organisation
e.g. 8 examples of organisational improvement as a result of whistleblowing
e.g. 9 evidence that feedback to the individual whistleblower has been consistently provided in a timely manner
e.g. 10 positive feedback from whistleblowers
- To receive a score of 'Good'
Obvious commitment and leadership from management. Near complete compliance with code with intention for complete compliance. Some examples of positive outcomes as a result of information gathered under sections four and five of the Code
e.g. 1 a ‘speak up’ culture that makes it safe to raise concerns
e.g. 2 good employee awareness, trust and confidence to raise concerns
e.g. 3 clear and easily usable practices and policies disseminated within the business
e.g. 4 consistent enforcement of whistleblower policies by managers
e.g. 5 training for managers on handling whistleblowing
e.g. 6 training for staff around whistleblowing
e.g. 7 employee engagement encouraged and facilitated at every level of the organisation
e.g. 8 keeping the issue live through reinforcement and messages
e.g. 9 communicating the outcome of whistleblowers’ efforts across the organisation
- To receive a score of 'Okay'
Some compliance with the code but the approach to whistleblowing is ad hoc
e.g. 1 ad hoc steps evident to deal with employee concerns about wrongdoing in the workplace
e.g. 2 some employee engagement, such as guidelines, training
e.g. 3 respect for confidentiality
- To receive a score of 'Poor'
The business acknowledges performance below expectations or no action evident
e.g. 1 no evidence of practices or policies to address employee concerns about wrongdoing in the workplace
e.g. 2 understanding of issue and risks not evident
e.g. 3 statement of future intent to improve